hxxp://e[.]vg/365 | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://e.vg/365
Sample261023-th7ejaez2l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{AB8FCD6F-5396-4C8B-8416-46CB0000C471}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 3048	1780	msedge.exe	81
PID 1780 wrote to memory of 2448	1780	msedge.exe	82
PID 1780 wrote to memory of 3612	1780	msedge.exe	83
PID 1780 wrote to memory of 2448	1780	msedge.exe	82
PID 1780 wrote to memory of 2448	1780	msedge.exe	82
PID 1780 wrote to memory of 1344	1780	msedge.exe	84
PID 1780 wrote to memory of 1344	1780	msedge.exe	84
PID 1780 wrote to memory of 576	1780	msedge.exe	86
PID 1780 wrote to memory of 576	1780	msedge.exe	86
PID 1780 wrote to memory of 576	1780	msedge.exe	86
PID 1780 wrote to memory of 2392	1780	msedge.exe	87
PID 1780 wrote to memory of 2392	1780	msedge.exe	87
PID 1780 wrote to memory of 2392	1780	msedge.exe	87
PID 1780 wrote to memory of 4732	1780	msedge.exe	88
PID 1780 wrote to memory of 4732	1780	msedge.exe	88
PID 1780 wrote to memory of 4732	1780	msedge.exe	88
PID 1780 wrote to memory of 2240	1780	msedge.exe	89
PID 1780 wrote to memory of 1308	1780	msedge.exe	90
PID 1780 wrote to memory of 2240	1780	msedge.exe	89
PID 1780 wrote to memory of 2240	1780	msedge.exe	89
PID 1780 wrote to memory of 2576	1780	msedge.exe	91
PID 1780 wrote to memory of 1308	1780	msedge.exe	90
PID 1780 wrote to memory of 1308	1780	msedge.exe	90
PID 1780 wrote to memory of 2576	1780	msedge.exe	91
PID 1780 wrote to memory of 2576	1780	msedge.exe	91
PID 1780 wrote to memory of 2020	1780	msedge.exe	95
PID 1780 wrote to memory of 4496	1780	msedge.exe	96
PID 1780 wrote to memory of 2020	1780	msedge.exe	95
PID 1780 wrote to memory of 4496	1780	msedge.exe	96
PID 1780 wrote to memory of 4060	1780	msedge.exe	97
PID 4060 wrote to memory of 4568	4060	msedge.exe	98
PID 1780 wrote to memory of 3676	1780	msedge.exe	100
PID 1780 wrote to memory of 2012	1780	msedge.exe	101
PID 1780 wrote to memory of 2012	1780	msedge.exe	101
PID 1780 wrote to memory of 2012	1780	msedge.exe	101
PID 1780 wrote to memory of 752	1780	msedge.exe	102
PID 1780 wrote to memory of 752	1780	msedge.exe	102
PID 1780 wrote to memory of 752	1780	msedge.exe	102
PID 1780 wrote to memory of 2344	1780	msedge.exe	103
PID 1780 wrote to memory of 2344	1780	msedge.exe	103
PID 1780 wrote to memory of 2344	1780	msedge.exe	103
PID 1780 wrote to memory of 1948	1780	msedge.exe	104
PID 1780 wrote to memory of 4572	1780	msedge.exe	105
PID 1780 wrote to memory of 3788	1780	msedge.exe	106
PID 1780 wrote to memory of 4920	1780	msedge.exe	107
PID 1780 wrote to memory of 4920	1780	msedge.exe	107
PID 1780 wrote to memory of 3388	1780	msedge.exe	109
PID 1780 wrote to memory of 3388	1780	msedge.exe	109
PID 1780 wrote to memory of 3388	1780	msedge.exe	109
PID 1780 wrote to memory of 4264	1780	msedge.exe	110
PID 1780 wrote to memory of 2388	1780	msedge.exe	111
PID 1780 wrote to memory of 2388	1780	msedge.exe	111
PID 1780 wrote to memory of 2388	1780	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://e.vg/365
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb235cc188,0x7ffb235cc194,0x7ffb235cc1a0
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,12147116079987502478,13547278021871283985,262144 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1648,i,951135557473255544,10914757982572252508,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,6148921275918237054,10726526596823152354,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,8701695089945592582,2084593872191091035,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13974649896522333328,5457072679247980455,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,14927688562018494424,12394679122182725093,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,429989906822847576,10416850295252675924,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,610890302026565394,14661893928609167843,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,10942736217410730402,14840767083677125391,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,6544482205706208939,1128084612396094155,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,17381038675188477974,16294232624079617699,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,1097521813858961653,4960278594883200514,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,15293856122708029581,9454682841931189319,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,15293856122708029581,9454682841931189319,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6532,i,14775292606999078335,6512074599357972908,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6160,i,10500893898601904438,6890621524367081845,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6564,i,8600731864632904196,8235243796768722224,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15953501199068733950,7004634600644150875,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,10757910286695810059,14836264824960948090,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,8279770292579195868,6995019668379472667,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,10627883838841892404,3808359101050776537,524288 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6276,i,14197005977140728552,6350225718659396274,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,1058262042227172980,14910804911705218460,262144 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6128,i,3903242550007812628,7273870000658814473,2097152 --field-trial-handle=2392,i,6762071416553478770,14781172508645787965,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

081838b8-b3d3-46e2-a8f5-a99d7cd7a816.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\081838b8-b3d3-46e2-a8f5-a99d7cd7a816.tmp
Size 21KB
SHA256 dd25eb8d49c8028254bb23103181a22cbc11c5ec7b439f500e9a293d54c64256
MD5 f02289c265d22fa0ed9292a02c3f3d24
SHA1 ef91ad8e63e0abc4ae79a1c7574a7f7664ea38c1
SHA512 65984bcabdfcedadc2e4b9ae4b0ea0a5251108530b1c196b99fecf63570b718e09b1baffecda11716b67aaf2a307b3f9f0f09a468652de4ab44bb282ad686634
SSDEEP 384:jiFzQkUSvJ8N+8TUNTUlIlWTN6kTC5SIbmYopg2IoIIl7:OFdJPwg6yCBg5oL5
TLSH
T166A25B368CA86C3F9EB6DE51F54A32438EB4816BCAD56B94E6CD6A1C01DB1CC1307E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f7b7816-2d87-45a1-ac29-4bd42596f7d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f7b7816-2d87-45a1-ac29-4bd42596f7d5.tmp
Size 18KB
SHA256 319c94e8374de2617843f04af77575ce2b604e6a717d58c1b6ad4c50fcb745d3
MD5 1756fd2e374c1b0ae37e0f73ce1dbb99
SHA1 b166b7a35b5fff5a3de6796d5dba980f1c5158b1
SHA512 901f9ba289207cfbd58dc404528ee8cd753041e23eba01da8a9cf60151312d0cd2ea6bae66004b5e606c5b97d97a2b8868d8b514b8774cb4ea223198f71d4bfe
SSDEEP 384:cQkUSv08NuBTN6kTC5SIbmYo1g2IoIIl7:c0jyCNg5oL5
TLSH
T1B8827C359CA82C3B8EB2E951F54A36438EB4811BDBC92F94D9DD2B2C05DA2DC1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34ee0cfe-28f1-4d32-b110-db81eeab4a26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34ee0cfe-28f1-4d32-b110-db81eeab4a26.tmp
Size 18KB
SHA256 1f80dfb40a779fd647ab0a9ac63f4a109c910c01f4084e07eb673541905436bc
MD5 0bd4a207254607ecd0ca1abb7d00ba35
SHA1 a26257ce9bdd4768265af0cbb3de9c115b1f1768
SHA512 b3bb576e5fae0ef89a70eed10619da70b83b2119bdeac57f3ef075bebcb943c6d617327333bf0b1bcad9493260f8efb4903643f88d55947ee5103bed4caec5a8
SSDEEP 384:JQkUSv08NuWTN6kTC5SIbmYo1g2IoIIl7:r0qyCNg5oL5
TLSH
T1A6827C359CA82C2B8EF3E951F54A36439EB4811BCBC92F94D9DD6B2C05DA2DC1307A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4da83f7c2db56b3b267d8673cd329c9ebe11518ed1355fee48e02e2eb7dc667
MD5 da5bf6bf079a2d0b72f1ba828bb869c4
SHA1 c5b477ca5fa0737bc5ec1d3971d7c5864a969233
SHA512 4bb0cdef8b5998fe4d7dca2c5da777f9d5541df6ec2a269e22d862e25cb11ad1dd6794d959246e60431138d67653ebeed6d6a8ad98885459f62f51a91e4f6048
TLSH
T17CD0222EFB232E02F800E332803CFB830200C0C3CC830A088E800222E8C38028C2B32F
MD5 SHA1 SHA512 TLSH

Submit Download

019ed509-a438-49b4-810f-1808c3813433.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\019ed509-a438-49b4-810f-1808c3813433.tmp
Size 10KB
SHA256 abf06b90a239df26483ba46b9ad59ed57fe7075fb6ac6665cf56ba1de8e82939
MD5 b5a4d24273e35c85400fd6ce91bec21f
SHA1 b1387d0566cbbac9c536d2225032f44ddfb1ba85
SHA512 674521103c069b8a7b6712bc18809d7f3f49b908dc1b5e9bf633768ff44a0c81502f49fd5451351850615f3a3a4c124a0f0c7bc928b573c94572665548740fe1
SSDEEP 192:sxZsRSb+/fSsX33ODIdpR3/856+WNjBi8/Y0CVxETaVIg5rJ:sxZs6+/fSsn3BV/tF/5Zsz
TLSH
T18722C9526E68653B8CCBD21EBB19BF53D2F9507291D11E48E6FC861C09EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26b92f36-8759-4e36-8e72-571918eb3813.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26b92f36-8759-4e36-8e72-571918eb3813.tmp
Size 9KB
SHA256 b772b4acdfa61a350d6d9132db5889d509ccddb990868b2707708d67c5d64839
MD5 4d9148dafd0a54dc621011c316197f2a
SHA1 fa79d726599f519a33f0439d0a8e29fe7ec24089
SHA512 edb3b9aa73466bf641f961514367b3bff522f367826dc5f767a572f2ecde81ef6201263a0657943fa12a5052fd06cfc67cd67d78aa01524f74505c3f3854c8b4
SSDEEP 192:sxZsRSb+/fSsm3CODIdpM/856+WNGY0C4xETaVIgrJ:sxZs6+/fSsKCBM/tG5Ms9
TLSH
T10C12B8526E28A53B8CC7E21EBB29BF43D6FD507291911E48EAFC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45b1680f-b132-4a7b-b8fb-69648dd31c37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45b1680f-b132-4a7b-b8fb-69648dd31c37.tmp
Size 10KB
SHA256 97035f12bf31b8d233b904f32eb6cea6841ab7d4c6cb9d3a2dbc69dbc4bdceeb
MD5 d3fc4beca450076d589db916dcf4dd1e
SHA1 c1c7e7ae5bfee76caeb933ee86bf76d007eedc1c
SHA512 c2953c532f74315dd1eb303e44c1ce813ea78ea7e1b6958654b1ee9b63fa1135ae7870fb43db04080b77a8bf1cabd0c1d691797ab4a2447799d05547251ba476
SSDEEP 192:sxZsRSb+/fSsX93ODIdpn3/856+WNjBi8/Y0CrxNTaVIg5JJ:sxZs6+/fSst3B3/tF/5Ksl
TLSH
T11422D9526E68693B8CCBE20DBB15BF53E2F9507291A11E48E6FC861C05FB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a27fbf1-9c18-4da8-ba73-acdee175a309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a27fbf1-9c18-4da8-ba73-acdee175a309.tmp
Size 10KB
SHA256 c26f53b67a87ca6e07ec9442e4fbe6f37b58cfba7825de78770c6167a508c2b0
MD5 9b7b64bafe5710e7dbc1e3d15cb6b83b
SHA1 0feed6299d9a694705e207ad3bd670cba3c285ff
SHA512 b97d9ba484311279964187d85b4aa99c78155d7d1bf4ba7e483a6dc04488598d7fc021ab2e76ad9ef88c28d237320df30dc3986870945d4355cb39ed51e29f21
SSDEEP 192:sxZsRSb+/fSsX93ODIdpR3/856+WNjBi8/Y0CmxmTaVIg5JJ:sxZs6+/fSst3BV/tF/54sl
TLSH
T1BA22C9526E68697B8CCBE20DBB15BF53E2F9507291911E48E6FC861C05FB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fb99c4c-2a0a-4a86-8833-82044c7bd5b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fb99c4c-2a0a-4a86-8833-82044c7bd5b1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 07b89b9a8df73e3fa5d68cbf0cac159d1642651abee14a9795fb55dfd0abcaf9
MD5 eac02f0d3e4efde98e4c036b7ed6fa53
SHA1 c95d128459644729fc51cb0a3bfcb7a493c6aab3
SHA512 b8fd6fc7e8853d771d1592cb0be9d86447b99859b5263cddbe209c0118d432b445399bb4f64e95862f75eb22f181fbca794e2ae3c7d72fbc586276c285a4dc9c
TLSH
T1BD516F80B17354E4DBACC1FE83D419D73D3754B0BE83EE512794F7BA4A0AF01A1A4044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e37fcd6128eab13919239036318789f0dbc3711ab240f650d8503d9d4ca52f70
MD5 287c0dbef5f02d08fcc6f4e6ace9ea05
SHA1 4ed8f590d307094a1507cbf6af2b9aba6d1145b6
SHA512 047f7bbb4ac32f2ae1e0f09bb18e515fe45f544f4b7eb307db0d29666a422a83073bf6aa36ccd414fc6edb7a0fa87caa52dd11bd37dbdfa4a3aff8078c514659
TLSH
T16B516F80B17354E4DBACC1FE839419D73D3754B0BE83ED522794F7BA8A0AF01A1A4044
MD5 SHA1 SHA512 TLSH

Submit Download

2a1fe2d1-4093-46cf-b5c9-6c126eb7b1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2a1fe2d1-4093-46cf-b5c9-6c126eb7b1ba.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

35434727-bce6-46f3-9a53-7a2409e69fe5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35434727-bce6-46f3-9a53-7a2409e69fe5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d68b548c-4db8-48f2-b12e-961377ca1d8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d68b548c-4db8-48f2-b12e-961377ca1d8f.tmp
Size 1KB
SHA256 e3cd73546deecb6d39b3cfd658e83c269daba13957f30a83e3cc1bd89c02e881
MD5 374ae8437dba95f187a1f2c728b10ff2
SHA1 6006ae5f927491d6356384cd2e27ba6f69bcc322
SHA512 802d3f53fe711e1bab7aa3c527754cc1b3d3818fc0d85efddba3b8792b5687bae6e52c5371fd00610f57a8c08baab5cd469ffe4d0b8fcb8cdd59ca74edb06cc0
TLSH
T1CC21DDF3C3D696AEC9111AF06B24AE2BCE1D090A42183C09C9E8EF1BD3E3031D10199F
MD5 SHA1 SHA512 TLSH

Submit Download

ea02e4c7-e1fd-490a-a260-89882225fdb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea02e4c7-e1fd-490a-a260-89882225fdb1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c835304e-50e1-4be0-9d28-fc72c1ac50d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c835304e-50e1-4be0-9d28-fc72c1ac50d0.tmp
Size 28KB
SHA256 1c1ae629f73380629f1f2b1a4f9c6f74ac27b8748db976c4dc98f3e21987a256
MD5 724b78c5d38e7dab2fabe5b86c92a781
SHA1 1e9540a4da5bb22e49754f431e6e8ed65b3dd0c7
SHA512 57b2479302cea665bb0665af255c4aa6412706fb42371d017e1345ae41bb41607a8389df9f2277e6b4f85650833474736c6b7e481253dbb42b4f9d536fb7cc4d
SSDEEP 768:RLlTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80f8aroRg:RLlTj8Gr2ymWRm+KQECu1jaKMxLpCNft
TLSH
T18CD20B3F240CCB7E4FC41A9DDD5A6F976E9802C7A6688D4047FE984C02D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61d3909c-d35f-4538-9b19-7a75d85b5c48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\61d3909c-d35f-4538-9b19-7a75d85b5c48.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0abc602-9e33-4dcf-95bf-d13ddf55f64b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0abc602-9e33-4dcf-95bf-d13ddf55f64b.tmp
Size 8KB
SHA256 b1b5d23d3469b43625487d79200ea65fea7aafb1e43e826f575d8cef2ec8873b
MD5 0ef0bd6e5a096e66e6eae67427a73395
SHA1 3368ab17847631cff205007345d08aa6862e34fe
SHA512 dfad494a5340723002559930bf85b65afbe3c159de0630a7351aac15df0818b81db85f0b5b57b7e1308395bddae4f7e0252cd17a66ad5f40651996a0f23fd456
SSDEEP 192:iGNn6Ub6QmiUyYFeW9XPaIhcUAPbPwoKPKhqxU6:iGNn6I27ekSIbmYo9gU6
TLSH
T1CE120A35A8B87C2F9EE3E955B48735035EA5421BDBC93F84D5EC2A1C05EF29C130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3db59a3e-5328-4e33-b10b-38f73d7a81c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3db59a3e-5328-4e33-b10b-38f73d7a81c3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3c6f6aa-7e74-4aba-b802-e51afc663a4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3c6f6aa-7e74-4aba-b802-e51afc663a4b.tmp
Size 8KB
SHA256 52dc6d0f466641a776eb841074965f8523ac81be7066b801f1f1c6b674d691bc
MD5 7c59b314e4319ae5d00283bbd7e9c793
SHA1 4b30b2117bbb03ea38a1711a3902ce00eee1dec8
SHA512 6e559bd07990cb2fce2a41ea13a378acb71eb0593102a554bf975b1127a05c016c15ce91f9839b9a5356bc93d3a3118cb9f2dcc51c3c5524548a0ccc29312bc8
SSDEEP 192:9GNS6UbxQmiUy4JpF+W9XPaIhcQr58eU6:9GNS6IPfJT+kSI7LU6
TLSH
T10102C638ACA83C7B9EF3EE15B58B66135FA5112BDA952F84D9E81A1C40D768C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download